self-hosted/teleport
self-hosted/teleport
1
0
Fork 0
mirror of https://github.com/gravitational/teleport synced 2024-10-19 16:53:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

permission-warning.mdx: Advise NOT TO give access,editor to users (#28091)

Browse source 
* permission-warning.mdx: Advise NOT TO give access,editor to users

* Give users an alternative rather than indicating what not to do

Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>

---------

Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
This commit is contained in:
Rafał Cieślak 2023-06-22 12:20:17 +02:00 committed by GitHub
parent 20dcb2b449
commit a82f2d8587
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
docs/pages/includes/permission-warning.mdx
View file

@ -12,7 +12,10 @@
numbered < `1024` (e.g. `443`).
- Follow the "Principle of Least Privilege" (PoLP). Don't give users
permissive roles when giving them more restrictive roles will do instead.
For example, assign users the built-in `access,editor` roles.
For example, don't assign users the built-in `access,editor` roles, which give
them permissions to access and edit all cluster resources. Instead, define
RBAC roles with the minimum required permissions for each user and configure
Access Requests for elevated permissions.
- When joining a Teleport resource service (e.g., the Database Service or
Application Service) to a cluster, save the invitation token to a file.
Otherwise, the token will be visible when examining the `teleport` command